roundhouse_ui 0.9.1 → 0.11.0

data/app/controllers/concerns/roundhouse_ui/job_set_browsing.rb

@@ -5,19 +5,100 @@ module RoundhouseUi
     extend ActiveSupport::Concern
 
     PER_PAGE = 25
+    # The longest needle worth honouring. A megabyte of `q` against twenty thousand
+    # entries took five seconds in one request — the substring scan is linear in
+    # both, so the needle is a free multiplier on someone else's CPU. Longer than
+    # any error message anyone searches for, and checked before any comparison
+    # runs (the same ordering as MAX_JOB_CLASS_NAME in lib/roundhouse_ui.rb).
+    # The parser owns the bound now — one definition, checked before any character
+    # of the input is inspected. Kept as a name because tests and the read-only
+    # guard refer to it.
+    MAX_QUERY_LENGTH = FilterQuery::MAX_LENGTH
     BULK_CAP = 1_000 # safety ceiling on a single match-set action
+    # `unfiltered` means "this action was not authorised". `reason` says why, in the
+    # words the operator should read — it was duplicated verbatim in two controllers.
+    Matched = Struct.new(:entries, :capped, :unfiltered, :reason, keyword_init: true)
+
+    NO_FILTER = "Refused: a bulk action needs a filter. Without one it would act on " \
+                "every job in the set, which is not what this control is for.".freeze
+
+    # Every filter, once per request, rather than re-derived in each action. The
+    # queue filter was already assigned in seven places across three controllers;
+    # class and error would have made that twenty-one, and a browse that read one
+    # filter while its bulk counterpart read another is the failure this whole
+    # file is arranged to prevent.
+    # Every filter this concern understands. One list, so "all of them" is a thing
+    # the code can say.
+    #
+    # Read from all five, written back as one. `?q=` is now the whole filter —
+    # `q=class=EmbeddingWorker error=KeyError stripe` — so a link, a form and a
+    # bookmark carry a single value that either travels or doesn't. It used to be
+    # five, and "the confirm form carried four of the five" is precisely how a dry
+    # run listing two jobs deleted five. The other four survive as a read-only
+    # legacy shape (FilterQuery.from_params), because somebody has them bookmarked.
+    FILTER_KEYS = %i[q tag queue class error].freeze
+
+    included do
+      before_action :load_filters
+      helper_method :active_filters
+    end
+
+    # The filters currently in force, as URL params. THE single serialization
+    # point: every URL and form that must preserve the filter starts from all of it
+    # and names only what it changes, so dropping one is not expressible.
+    #
+    # This was hand-enumerated at six sites. Adding the class/error pair updated
+    # three of them, and the confirm form was one of the three that were missed —
+    # so a dry run listing two jobs POSTed a request that deleted five, and
+    # reported "Deleted 5 matching job(s)" as if that had been approved. The
+    # comment above bulk_matches promises the dry run and the action "cannot
+    # disagree about what matching means". They could, because they were handed
+    # different filters.
+    def active_filters
+      { q: filter.to_s.presence }.compact
+    end
+
+    # One parse per request, and everything else reads off it. The ivars below are
+    # kept because entry_selected? and TagsHelper are written against them; they are
+    # now views onto @filter rather than five independent reads of params, so
+    # "the browse read one filter while its bulk counterpart read another" is no
+    # longer a shape this code can take.
+    def load_filters
+      @filter = FilterQuery.from_params(params)
+      @query = @filter.text
+      @tag = @filter.tag_pair
+    end
+
+    # The parsed filter, never nil. entry_selected? is reachable without going
+    # through load_filters — the real-Redis tests drive bulk_apply directly, and so
+    # could a future action — and a NoMethodError inside the scan predicate is a 500
+    # on a page that was only browsing. FilterQuery.none matches everything, which is
+    # the same thing "no filter" has always meant here; bulk stays gated because
+    # bulk_filter_present? finds nothing to narrow on.
+    def filter = @filter ||= FilterQuery.none
+
+    # A refused query selects nothing, rather than being truncated to something
+    # shorter that would select MORE. Truncation is the tempting fix and the wrong
+    # one: it silently widens, and this predicate drives Delete.
+    def query_refused? = filter.invalid?
 
     # Returns [entries_for_page, has_next?]. Scans only far enough to fill the
     # requested page plus one (to know if a next page exists) — never loads the
     # whole set, so a 50k dead set stays cheap to page through.
-    def browse(set, query, page, per = PER_PAGE)
+    # `tag=key:value` inside ?q= — exact, against a host-defined tag (ADR 0002).
+    # Tag values are also in the free-text haystack; safe only because browse and
+    # bulk_apply share this one predicate.
+    def tag_filter = filter.tag_pair
+
+    def browse(set, query, page, per = PER_PAGE, tag: nil)
       start = (page - 1) * per
       jobs = []
       has_next = false
       matched = 0
+      cache = tag_cache_for(tag)
 
       set.each do |entry|
-        next if query.present? && !entry_matches?(entry, query)
+        next unless entry_selected?(entry, query, tag, cache)
 
         if matched < start
           matched += 1
@@ -36,26 +117,179 @@ module RoundhouseUi
     # Apply an op ("retry"/"delete") to every entry matching the query, capped at
     # BULK_CAP. Entries are collected first, then acted on — mutating a Sidekiq set
     # mid-iteration skips entries. Returns [count_acted_on, capped?].
-    def bulk_apply(set, query, op, cap = BULK_CAP)
-      matches = []
+    # The same scan the action runs, stopped one step early, so a dry run and the
+    # action it confirms cannot disagree about what "matching" means.
+    # Is any filter active? The single source of truth for "this bulk action has a
+    # scope". tags_helper's any_filter? delegates here rather than recomputing it —
+    # the view and the route disagreeing is exactly how the hole below happened.
+    def bulk_filter_present?(query, tag)
+      return false if query_refused?
+      # A DEGRADED query dropped a facet it could not use. Browse proceeds on what
+      # survived — that is the point of dropping rather than refusing — but what
+      # survived selects a SUPERSET of what was typed. `tag=garbage queue=default`
+      # becomes `queue=default`, so a Delete here would take the whole queue while
+      # the operator believed the tag narrowed it too. Browse and bulk still read
+      # one identical filter; bulk just declines to act on a widened one.
+      return false if filter.degraded?
+
+      # Reads the SAME parse entry_selected? reads. It used to read @class_filter and
+      # friends while the predicate read the FilterQuery, and the two diverged the
+      # moment wildcards moved the predicate over: a class-filtered bulk delete found
+      # a filter here, found none in the predicate, and took every row in the set.
+      # Caught by test_the_class_filter_alone_still_spares_a_longer_name. Those ivars
+      # are gone now, so the two cannot be given different answers.
+      query.present? || !tag.nil? || filter.any_facets?
+    end
+
+    # Why a bulk action was not authorised, in the words to show the operator.
+    def bulk_refusal_reason
+      return "Refused: that search was not understood, so it selects nothing. #{filter.message}" if query_refused?
+      return "Refused: #{filter.notes.join(' ')} Fix the search and the bulk actions come back — " \
+             "acting now would touch every job the dropped filter would have excluded." if filter.degraded?
+
+      NO_FILTER
+    end
+
+    def bulk_matches(set, query, cap = BULK_CAP, tag: nil)
+      # An unfiltered bulk action selects EVERY entry: entry_selected? finds no
+      # filter to fail, `"".present?` is false, and `return true if tag.nil?` does
+      # the rest. So POST /dead/bulk_all with nothing but op=delete emptied the set,
+      # up to the cap, and reported "Deleted 50 matching job(s)" as if that were
+      # the request. Verified against a real Redis before this guard existed.
+      #
+      # The comment above bulk_all claimed it was "only offered when a filter is
+      # active" — and it was only OFFERED that way. The button was hidden by the
+      # view while the route stayed open. The guard belongs here, at the one place
+      # both the dry run and the action pass through, not in a before_action that
+      # the next destructive action can forget to add.
+      unless bulk_filter_present?(query, tag)
+        return Matched.new(entries: [], capped: false, unfiltered: true, reason: bulk_refusal_reason)
+      end
+
+      entries = []
       capped = false
+      cache = tag_cache_for(tag)
       set.each do |entry|
-        next if query.present? && !entry_matches?(entry, query)
+        next unless entry_selected?(entry, query, tag, cache)
 
-        matches << entry
-        if matches.size >= cap
+        entries << entry
+        if entries.size >= cap
           capped = true
           break
         end
       end
-      matches.each { |entry| op == "delete" ? entry.delete : entry.retry }
-      [ matches.size, capped ]
+      Matched.new(entries: entries, capped: capped)
+    end
+
+    def bulk_apply(set, query, op, cap = BULK_CAP, tag: nil)
+      found = bulk_matches(set, query, cap, tag: tag)
+      return found if found.unfiltered
+
+      found.entries.each { |entry| op == "delete" ? entry.delete : entry.retry }
+      found
+    end
+
+    # Both the browse and bulk paths run every candidate through this, so the
+    # rows an operator sees are exactly the rows a bulk action will touch —
+    # including when a tag value is what matched the free-text search.
+    def entry_selected?(entry, query, tag, cache)
+      return false if query_refused?
+      # Compared through the filter, not with ==, so `class=Roundhouse%` narrows here
+      # exactly as it does on the dry run and the bulk action — all three read this
+      # one predicate. Without a `%` it is still a plain equality: `queue=default`
+      # must never also select `default_low`.
+      return false unless filter.matches_facet?(:queue, entry.queue)
+      return false unless filter.matches_facet?(:klass, RoundhouseUi.unwrapped_class(entry.klass, entry.item))
+      return false unless filter.matches_facet?(:error, entry.item["error_class"])
+
+      tags = entry_tags(entry, cache)
+      return false if query.present? && !entry_matches?(entry, query, tags)
+      return true if tag.nil?
+
+      entry_tagged?(tags, tag)
+    end
+
+    # `?queue=name` — exact match, so clicking a queue pill or picking one from
+    # the palette narrows to that queue. Exact rather than substring because
+    # this feeds bulk_apply too, and "default" must never also select
+    # "default_low".
+    def queue_filter = filter.queue
+
+    # `class=` and `error=` — the pair behind "find more like this", and typeable.
+    # Exact unless you add a %: these render the "delete all matching" buttons
+    # beneath them, and a bare substring would select jobs whose ARGUMENTS merely
+    # mention the class.
+    #
+    # Class is compared unwrapped, so the filter means the same string the row
+    # displays and the same one the Errors page groups by — one definition of
+    # "the same problem" across the console.
+    def class_filter = filter.klass
+
+    def error_filter = filter.error
+
+    def entry_tagged?(tags, (key, value))
+      # A declared vocabulary is authoritative: filtering on a key the host
+      # never declared matches nothing rather than everything.
+      declared = Tags.filters
+      return false if declared && !declared.key?(key)
+
+      # `tag=squad:plat%` wildcards the VALUE only. The key stays exact, because it
+      # is checked against the declared vocabulary above and a wildcarded key would
+      # walk straight past that check.
+      pattern = FilterQuery::Pattern.for(value)
+      return pattern.match?(tags[key.to_s]) if pattern
+
+      Tags.match?(tags, key, value)
+    end
+
+    def entry_tags(entry, cache)
+      return Tags::EMPTY unless RoundhouseUi.job_tags
+
+      Tags.for(klass: entry.klass, item: entry.item, cache: cache)
+    end
+
+    # Shares the request memo with TagsHelper — controller ivars carry into the
+    # view, so an entry resolved while scanning is not resolved again when its
+    # badge renders. Tags.for picks the key: class name normally, jid in per-job
+    # mode.
+    def tag_cache_for(_tag)
+      @rh_tag_cache ||= {}
     end
 
-    def entry_matches?(entry, query)
+    # Tag values are part of the haystack, so typing a squad name finds its jobs
+    # without reaching for the structured filter. Safe to widen here only because
+    # browse and bulk_apply share this predicate — if they diverged, a search
+    # would show one set of rows and "delete all matching" would act on another.
+    def entry_matches?(entry, query, tags = Tags::EMPTY)
       needle = query.downcase
-      [ entry.klass, entry.jid, entry.item["error_class"], entry.item["error_message"], entry.args.to_s ]
-        .any? { |hay| hay.to_s.downcase.include?(needle) }
+      # Queue matches on equality, not substring: typing a queue name should
+      # find its jobs, but this predicate also drives bulk_apply, so "default"
+      # must never additionally select "default_low".
+      return true if entry.queue.to_s.downcase == needle
+
+      # The unwrapped class is added rather than substituted. Since bulk actions
+      # run through this same predicate, replacing would silently empty a saved
+      # or habitual "JobWrapper" query — safe in direction, but a bulk query
+      # that used to select thousands would quietly select none. Appending only
+      # ever widens, and the real class name starts working.
+      item = entry.item
+      cheap = [ entry.klass, RoundhouseUi.unwrapped_class(entry.klass, item), entry.jid,
+                item["error_class"], item["error_message"], *tags.values ]
+      return true if cheap.any? { |hay| hay.to_s.downcase.include?(needle) }
+
+      # Arguments are searched REDACTED — exactly as they are displayed.
+      #
+      # Searching the raw values turned this box into an oracle. The UI masks
+      # api_token, but `q=sk_live_S` matched and `q=sk_live_X` did not, so a secret
+      # could be read out one character at a time by someone who can see the console
+      # and not the secrets — which is the whole population redact_args exists for.
+      # A sixteen-character token falls in a couple of hundred queries, and the same
+      # needle scopes a bulk delete, so the oracle worked through the dry run too.
+      #
+      # Also computed last, and only if the cheap fields missed. It used to be built
+      # eagerly into the array above, so every entry paid for stringifying its
+      # arguments whether or not anything else had already matched.
+      Redaction.apply(entry.args).to_s.downcase.include?(needle)
     end
   end
 end

data/app/controllers/roundhouse_ui/application_controller.rb

@@ -5,14 +5,58 @@ module RoundhouseUi
     # Isolated engines don't auto-include the host's helpers; include ours.
     helper ObservabilityHelper
     helper NavHelper
+    helper TagsHelper
     helper_method :content_nonce
 
+    # Forgery protection, shipped rather than inherited. ActionController::Base
+    # only carries this because the host's `config.load_defaults` (5.2+) put it
+    # there, so an app on older defaults mounts a console where every
+    # destructive POST is forgeable — while our own README promises the
+    # opposite. Same argument as the CSP below: the engine states its security
+    # posture instead of hoping the host set one. AssetsController opts out,
+    # deliberately and in writing.
+    protect_from_forgery with: :exception
+
     # Self-contained CSP, set per-request on our own responses so Roundhouse is
     # safe to mount even when the host sets no policy — and never weakens one it
     # does (this header only applies to engine responses). Strict default; we
     # enumerate exactly what our pages use (same-origin only, nonce'd inline JS).
     after_action :set_content_security_policy
 
+    # Read-only enforcement, fail closed. Every POST is treated as a write unless
+    # its controller says otherwise, so a destructive action added tomorrow is
+    # guarded the moment it exists rather than the moment someone remembers a
+    # before_action. This used to be seven near-identical `require_writable!`
+    # methods, each wired to a hand-maintained `only:` list — all seven correct,
+    # and all seven one omission away from silently not being.
+    #
+    # `guard_in_read_only` covers the dry-run GETs: a preview shows what a bulk
+    # action would do, and is gated with the action it previews.
+    class_attribute :read_only_exempt_actions, default: [].freeze, instance_writer: false
+    class_attribute :read_only_extra_actions,  default: [].freeze, instance_writer: false
+
+    def self.allow_in_read_only(*actions)
+      self.read_only_exempt_actions = actions.map(&:to_s).freeze
+    end
+
+    def self.guard_in_read_only(*actions)
+      self.read_only_extra_actions = actions.map(&:to_s).freeze
+    end
+
+    before_action :require_writable!, if: :read_only_guarded_action?
+
+    # Capability gating, same shape as the read-only guard above. A control the
+    # backend cannot deliver is hidden in the view AND refused at the route —
+    # hiding the button while leaving the route open is how an ungated bulk_all
+    # emptied a set once already.
+    class_attribute :capability_gates, default: {}.freeze, instance_writer: false
+
+    def self.requires_capability(capability, only:)
+      self.capability_gates = capability_gates.merge(capability => Array(only).map(&:to_s)).freeze
+    end
+
+    before_action :require_capability!, unless: -> { self.class.capability_gates.empty? }
+
     # Record every state-changing (POST) action. Actions halted by a
     # before_action (e.g. read-only mode) never reach here, so we only log what
     # actually ran.
@@ -42,6 +86,36 @@ module RoundhouseUi
       RoundhouseUi.backend
     end
 
+    def read_only_guarded_action?
+      return false if self.class.read_only_exempt_actions.include?(action_name)
+
+      request.post? || self.class.read_only_extra_actions.include?(action_name)
+    end
+
+    def require_capability!
+      missing = self.class.capability_gates.find do |capability, actions|
+        actions.include?(action_name) && !backend.supports?(capability)
+      end
+      return if missing.nil?
+
+      redirect_to root_path,
+        alert: "#{missing.first.to_s.tr('_', ' ').capitalize} is not available on this backend."
+    end
+
+    def require_writable!
+      return unless RoundhouseUi.read_only
+
+      redirect_to read_only_redirect_path,
+                  alert: "Roundhouse is in read-only mode — this action is disabled."
+    end
+
+    # Where someone lands when a write is refused. The buttons still render in
+    # read-only mode, so this fires on an ordinary click and the destination is
+    # worth getting right; sections override it to send you back where you were.
+    def read_only_redirect_path
+      root_path
+    end
+
     def record_audit_event
       target = params[:name] || params[:jid] || params[:id] || params[:job_class] ||
                (params[:jids].presence && "#{Array(params[:jids]).size} jobs") || params[:op]

data/app/controllers/roundhouse_ui/audit_controller.rb

@@ -1,5 +1,6 @@
 module RoundhouseUi
   class AuditController < ApplicationController
+    requires_capability :redis, only: %i[index]
     def index
       @entries = RoundhouseUi::Audit.recent
     end

data/app/controllers/roundhouse_ui/busy_controller.rb

@@ -1,15 +1,20 @@
 module RoundhouseUi
-  # What's executing right now, from Sidekiq::WorkSet — the live in-flight jobs
+  # What's executing right now, via the backend port — the live in-flight jobs
   # Sidekiq Web calls "Busy". Surfaces long-running (possibly hung) jobs, which
   # the stock UI makes you eyeball.
   class BusyController < ApplicationController
     LONG_RUNNING = 60 # seconds
 
-    before_action :require_writable!, only: :cancel
+    before_action :require_cancellable!, only: :cancel
 
     def index
       @threshold = LONG_RUNNING
       @work = backend.busy
+      # "4m 12s" means nothing on its own — fine for a nightly rollup, a hang for
+      # a webhook. DurationCollector already records the average per class, so
+      # where it is enabled the page can say "×8 typical" instead. Empty
+      # otherwise, and the view degrades to elapsed with no ceiling.
+      @typical = typical_durations
     end
 
     def cancel
@@ -19,9 +24,24 @@ module RoundhouseUi
 
     private
 
-    def require_writable!
-      return unless RoundhouseUi.read_only
-      redirect_to busy_path, alert: "Roundhouse is in read-only mode — cancellation is disabled."
+    def read_only_redirect_path = busy_path
+
+    # Average seconds per class, keyed by the real job class so an ActiveJob
+    # wrapper does not collapse every mailer into one baseline.
+    def typical_durations
+      return {} unless RoundhouseUi.collect_durations
+
+      DurationCollector.summary.to_h { |d| [ d[:klass].to_s, d[:avg_ms].to_f / 1000.0 ] }
+    rescue StandardError
+      {}
+    end
+
+    # Hiding the button is presentation; this is the control. Without a backend
+    # that can cancel and a host-side check that reads the flag, cancel! only
+    # writes a JID nobody consumes.
+    def require_cancellable!
+      return if RoundhouseUi.cancel_enabled && backend.supports?(:cancel)
+      redirect_to busy_path, alert: "Cancellation is not enabled — see RoundhouseUi.cancel_enabled."
     end
   end
 end

data/app/controllers/roundhouse_ui/dashboard_controller.rb

@@ -1,21 +1,37 @@
 module RoundhouseUi
-  # The dashboard reads straight from Sidekiq's API — no database, no models.
+  # The dashboard reads through the backend port — no models of ours, no storage of ours.
   # Everything here comes out of Redis via Sidekiq::Stats / Sidekiq::Queue.
   class DashboardController < ApplicationController
     def show
       @stats  = backend.stats
-      @queues = backend.queues
+      # queue_summaries, not queues: the raw objects differ per backend and older
+      # SolidQueue::Queue has no #latency, so the dashboard 500'd on solid_queue 1.0.0
+      # as soon as one queue existed. Summaries are ours, batched, and uniform.
+      @queues = backend.queue_summaries
       @metrics = Metrics.new(stats: @stats)
       @health  = Health.new(stats: @stats, queues: @queues, metrics: @metrics)
       # Highest-signal slices for the overview, from data we already read.
       @top_errors = ErrorGroups.new(limit: 200).call.groups.first(5)
       @problem_queues = @queues.select { |q| q.latency > 5 }.sort_by { |q| -q.latency }.first(5)
+      # Daily counts Sidekiq already keeps (#61). One read on render, not on the
+      # poll — a six-month window is not something to re-fetch every few seconds.
+      @history_days = History.clamp(params[:history].presence || History::DEFAULT_DAYS)
+      @history = History.days(@history_days)
+      @typical_failure_rate = History.typical_failure_rate(@history)
     end
 
     # Polled by the dashboard for live counts (same approach Sidekiq Web uses —
     # cheap JSON, no WebSocket/build step required).
     def stats
       s = backend.stats
+      # queues was already loaded here for the count, so the names ride along
+      # free — the command palette uses them to tell a queue name from a plain
+      # search term without adding a Redis call to every page render.
+      # queue_summaries, not queues: Sidekiq::Queue#size issues its own LLEN, so
+      # reading a depth per queue off `queues` would put one round-trip per queue
+      # on the endpoint every open tab hits every few seconds — the same N+1 that
+      # was removed from the Queues page. This is two round-trips at any queue count.
+      qs = backend.queue_summaries
       render json: {
         processed: s.processed,
         failed:    s.failed,
@@ -24,7 +40,15 @@ module RoundhouseUi
         scheduled: s.scheduled_size,
         retries:   s.retry_size,
         dead:      s.dead_size,
-        queues:    backend.queues.size
+        queues:      qs.size,
+        # Names ride along as the keys. They used to be sent separately as well,
+        # which meant every queue name appeared twice in one response — 40KB per
+        # poll per open tab on a 500-queue app, half of it duplicated.
+        queue_depths: qs.to_h { |q| [ q.name, q.size ] },
+        # Total worker threads, for the capacity figure (#36). workers_size is
+        # threads *busy right now*, which is a different number and goes to zero
+        # on an idle fleet — dividing by it would claim infinite capacity.
+        concurrency: backend.respond_to?(:concurrency) ? backend.concurrency : nil
       }
     end
   end

data/app/controllers/roundhouse_ui/dead_controller.rb

@@ -2,13 +2,12 @@ module RoundhouseUi
   class DeadController < ApplicationController
     include JobSetBrowsing
 
-    before_action :require_writable!, only: %i[requeue destroy bulk bulk_all]
+    guard_in_read_only :preview
 
     def index
-      @query = params[:q].to_s.strip
       @page  = [ params[:page].to_i, 1 ].max
       @total = backend.dead_set.size
-      @jobs, @has_next = browse(backend.dead_set, @query, @page)
+      @jobs, @has_next = browse(backend.dead_set, @query, @page, PER_PAGE, tag: @tag)
     end
 
     def requeue
@@ -40,18 +39,36 @@ module RoundhouseUi
     # selected/visible ones), capped for safety. Only offered when a filter is
     # active, so it can't become "retry the entire dead set" by accident.
     def bulk_all
-      count, capped = bulk_apply(backend.dead_set, params[:q].to_s.strip, params[:op])
+      found = bulk_apply(backend.dead_set, @query, params[:op], BULK_CAP, tag: @tag)
+
+      # An unfiltered bulk_all selected every entry and reported it as a match.
+      # The comment above claimed this was "only offered when a filter is active" —
+      # and it was only OFFERED that way; the route had no gate. bulk_matches now
+      # refuses at the chokepoint, and this says so out loud rather than reporting
+      # "Deleted 0 matching job(s)", which would read like an empty set.
+      if found.unfiltered
+        return redirect_to dead_set_path, alert: found.reason
+      end
+
       verb = params[:op] == "delete" ? "Deleted" : "Re-enqueued"
-      note = "#{verb} #{count} matching job(s)."
-      note += " Stopped at the #{JobSetBrowsing::BULK_CAP} cap — run again for more." if capped
+      note = "#{verb} #{found.entries.size} matching job(s)."
+      note += " Stopped at the #{JobSetBrowsing::BULK_CAP} cap — run again for more." if found.capped
       redirect_to dead_set_path, notice: note
     end
 
+    # A dry run: the count tells you how many match, this tells you which (#37).
+    def preview
+      @op = params[:op] == "delete" ? "delete" : "retry"
+      @matched = bulk_matches(backend.dead_set, @query, JobSetBrowsing::BULK_CAP, tag: @tag)
+      @confirm_path = bulk_all_dead_path
+      @back_path = dead_set_path
+      @set = "dead"
+      @noun = "dead job"
+      render "roundhouse_ui/shared/bulk_preview"
+    end
+
     private
 
-    def require_writable!
-      return unless RoundhouseUi.read_only
-      redirect_to dead_set_path, alert: "Roundhouse is in read-only mode — retry and delete are disabled."
-    end
+    def read_only_redirect_path = dead_set_path
   end
 end

data/app/controllers/roundhouse_ui/errors_controller.rb

@@ -3,11 +3,70 @@ module RoundhouseUi
   # (job class + error class) — so one bad deploy reads as a single issue with
   # a count, not five thousand identical rows. The aggregation Sidekiq Web lacks.
   class ErrorsController < ApplicationController
+    # The facets a GROUP can be narrowed by. No queue=: a klass|error group spans
+    # every queue its jobs were enqueued on, so there is nothing here for it to
+    # apply to — and a pill that filters nothing is the phantom filter the bar
+    # exists to prevent. The parser refuses it and says which page it works on.
+    FILTER_KEYS = %w[class error tag text].freeze
+
     def index
-      @query = params[:q].to_s.strip
+      @filter = FilterQuery.from_params(params, keys: FILTER_KEYS)
+      @query = @filter.text
       @scan_limit = ErrorGroups::DEFAULT_SCAN_LIMIT
       result = ErrorGroups.new(query: @query).call
       @groups, @scanned, @truncated = result.groups, result.scanned, result.truncated
+
+      # Tags resolve per group rather than per entry: every row in a
+      # klass|error group shares a class, so a class-derived tag is constant
+      # for the group. Counted before filtering, so the quick-filter strip
+      # keeps showing every squad's total while one of them is selected.
+      @group_tags = @groups.to_h { |g| [ g[:klass], Tags.for(klass: g[:klass], item: {}, cache: tag_cache) ] }
+      @tag_counts = tag_counts(@groups)
+      @tag = tag_filter
+      @groups = @groups.select { |g| group_tagged?(g, *@tag) } if @tag
+
+      # class= and error= match EXACTLY, the same as on the job sets, so a funnel
+      # clicked there and a facet typed here mean one thing. Filtered in memory:
+      # grouping has already read the entries, so this costs no extra Redis work.
+      #
+      # A refused query selects nothing rather than everything — the same direction
+      # the job sets fail in. Errors has no destructive action, but "nothing matched"
+      # must not read as "no such failures exist", which is why the banner renders.
+      @groups = [] if @filter.invalid?
+      @groups = @groups.select { |g| @filter.matches_facet?(:klass, g[:klass]) }
+      @groups = @groups.select { |g| @filter.matches_facet?(:error, g[:error]) }
+    end
+
+    private
+
+    # `?tag=key:value`, read off the one parse like everywhere else rather than
+    # re-split from params — two readings of one filter is how a page comes to show
+    # one scope and act on another.
+    def tag_filter = @filter.tag_pair
+
+    # Fail CLOSED on an undeclared key, like the job sets do. Returning nil here meant
+    # no filter applied, so `?tag=nosuchkey` listed every issue while the bar showed a
+    # tag pill — the README promises the opposite.
+    def group_tagged?(group, key, value)
+      declared = Tags.filters
+      return false if declared && !declared.key?(key)
+
+      Tags.match?(@group_tags[group[:klass]], key, value)
+    end
+
+    # { "squad" => { "core" => 4, "training" => 5 } } — the counts behind the
+    # quick-filter strip, from groups already scanned, so this costs no extra
+    # Redis work.
+    def tag_counts(groups)
+      counts = Hash.new { |h, k| h[k] = Hash.new(0) }
+      groups.each do |g|
+        @group_tags[g[:klass]].each { |key, value| counts[key][value] += g[:count] }
+      end
+      counts
+    end
+
+    def tag_cache
+      @rh_tag_cache ||= {}
     end
   end
 end

data/app/controllers/roundhouse_ui/jobs_controller.rb

@@ -5,6 +5,8 @@ module RoundhouseUi
   # Sidekiq has no in-place edit: a job in a set is keyed by its payload, so an
   # "edit" is delete-the-old + push-the-modified.
   class JobsController < ApplicationController
+    # backend.push is Sidekiq-only; without it Edit had nothing to re-enqueue into.
+    requires_capability :enqueue, only: %i[new create edit update]
     REDIRECTS = { "dead" => :dead_set_path, "retry" => :retries_path, "scheduled" => :scheduled_path }.freeze
 
     before_action :require_editing_enabled!, except: :show
@@ -50,8 +52,10 @@ module RoundhouseUi
       klass = params[:job_class].presence || entry.item["class"]
       queue = params[:queue].presence || entry.queue
 
-      entry.delete
+      # Push BEFORE delete. Reversed, a backend that cannot push (Solid Queue raises
+      # NotImplementedError) left the job deleted and gone.
       backend.push("class" => klass, "queue" => queue, "args" => args)
+      entry.delete
       redirect_to send(REDIRECTS[params[:set]]), notice: "Edited & re-enqueued #{klass} → #{queue}."
     rescue ArgumentError => e
       @action_path = job_path(set: params[:set], jid: params[:jid])